Twelve months ago, choosing a partner to build an AI agent was a delivery decision: which vendor could ship the prototype fastest, on which orchestration stack, at which day rate. In 2026, that frame is obsolete. The 17 June 2026 announcement — reported by PR Newswire — that Barcelona-based **NeuralTrust** raised **USD 20 million** in what is described as **the largest cybersecurity seed round by an EU company to date**, explicitly to secure enterprise AI agents, is the clearest single signal. The companion signal is **OWASP's 2026 report**, covered by Help Net Security on 11 June 2026, placing **prompt injection at the center of agentic-AI risk**.
Once a category attracts that profile of attention, security stops being an internal concern and becomes a **contracting question**: who is liable when the agent your vendor built leaks the customer database; whose SDLC produced the vulnerable orchestration code; whose log is admissible when the regulator asks; whose insurance pays.
This article is the buyer-side checklist for that decision. Its companion piece, [AI agent security in 2026: the enterprise defense playbook](https://callitdev.com/en/blog/ai-agent-security-prompt-injection-enterprise-playbook-2026), covers the defense of agents you already run. This one covers the procurement of the partner that will build the next ones.
In every well-structured AI agent build engagement, three security responsibilities exist; the contract names the owner of each.
A vendor selection process that does not produce a clear named owner for each of the three is incomplete, regardless of how impressive the prototype demo was.
The ten items below are the ones our procurement counterparties in Europe and North America have begun to require explicitly in RFPs. A vendor that cannot answer them in writing is not in the AI-agent-development tier in 2026; they are in the AI-prototype-development tier, which is a different category at a different price point and a different risk profile.
Where will training data, fine-tuning data, prompts, and inference logs be stored, processed, and backed up? Which sub-processors are involved (model providers, vector DB hosts, monitoring SaaS)? Which jurisdictions? For European buyers, an explicit answer that names EU-region inference endpoints and EU-region log storage is now standard. For regulated buyers, a DPIA-ready dataflow diagram, not a generic privacy policy, is the test.
Who pays when an indirect prompt injection causes the agent to exfiltrate data, send an unauthorised email, or trigger an unauthorised transaction? The 2026 norm is a **shared liability model** with a cap proportional to fees, contingent on the partner demonstrating that the design controls in the contract were implemented. A vendor that refuses any liability for security defects in their own code is selling on yesterday's terms.
Source control with mandatory review; dependency scanning (SCA) on every build with a published policy on severity thresholds; secrets management (no plaintext credentials in repos, in prompts, in agent contexts); signed and reproducible artefacts; an SBOM for every release, and an **AI-BOM** that inventories the models, prompts, agents, datasets, and tool integrations shipped. The AI-BOM is the diagnostic clause: vendors who already produce one are operating at the 2026 standard; vendors who have to invent one for your contract will invent it badly.
A pen test of a 2024 web application is not a pen test of a 2026 agent. The contract should require **agent-aware pen-testing** that exercises direct injection, indirect injection through every untrusted input source, tool-result injection, privilege-escalation across agent handoffs, and sandbox-escape against the orchestration framework. Microsoft Security Blog's May 2026 disclosures of RCE in agent frameworks make the sandbox-escape test non-negotiable. Pen-test cadence: at acceptance, after every major change, and at least annually thereafter.
The contract specifies that every tool credential the agent holds is scoped to the minimum operation required, that destructive operations require an out-of-band approval, that tool credentials rotate on a schedule, and that the agent never holds the credentials needed to escalate its own privileges. This is the single design clause that converts a likely incident into a recoverable one.
Every agent action — system prompt, user prompt, tool call, tool response, model/version, timestamp, side effect — is logged into a store **the buyer can access** for at least the contractually-agreed retention period. The buyer has the right to audit the log on reasonable notice. The store is append-only and replicated outside the partner's primary environment.
Classical SLAs measure uptime and latency. Agent SLAs add quality and safety: a maximum allowable rate of refused-when-shouldn't, a maximum allowable rate of accepted-when-shouldn't, a maximum allowable rate of hallucinated tool calls, and a defined response time for security-incident triage. The SLA enforces that the partner's incentive aligns with the buyer's risk, not only the buyer's uptime.
A defined **incident path**, contractually committed: who is paged within how long, who quarantines the agent, who notifies the buyer, who notifies the regulator if notification is required, and how the post-incident report is delivered. Notification windows of 24 to 72 hours, matched to GDPR Article 33 where applicable, are the European norm.
The contract specifies the buyer's right to terminate, the partner's obligation to transition prompts, agent definitions, datasets, fine-tuned models and logs in a portable format, the duration and price of transition assistance, and the destruction certificate for any residual data. A vendor that resists portable export is a vendor optimising for lock-in, which in agent engagements is a security risk in addition to a commercial one — locked-in buyers under-invest in second-source resilience.
Cyber-liability insurance with limits commensurate with the data exposure; SOC 2 Type II or ISO 27001 for the operating environment; named coverage for AI-specific risks where the policy market supports it (a small but growing 2026 line). The certifications are necessary, not sufficient. Most breached vendors of 2025–2026 held at least one active certification.
Once the security checklist is in place, the partner-selection conversation moves to delivery economics. Three structural facts about Morocco are worth pricing into the comparison.
Translated to the AI-agent procurement decision: Morocco is a credible nearshore option for European buyers who want a CET-aligned partner with the engineering depth to ship the design controls in the checklist above, and the cost basis to fund the secure-SDLC overhead without inflating the contract.
A defensible 2026 shortlisting workflow runs in five steps. First, distribute the ten-item security checklist as a long-form RFI, not as a tick-box; require written answers and named owners. Second, run a one-hour technical interview with the vendor's most senior engineer assigned to the engagement, focused on the indirect-injection and sandbox-escape design decisions in their reference architecture. Third, request a redacted excerpt of a previous incident report — vendors that have never produced one have either not been in production or have not been writing them. Fourth, require a reference call with a buyer of comparable size operating in a comparable jurisdiction. Fifth, score against the checklist with a weighted matrix and document the gaps for the partner to close before signature.
A vendor that fails any single item is not automatically disqualified — the right answer for some items is "this is the buyer's responsibility, here is how we support it." A vendor that fails the checklist as a whole is disqualified.
Call IT Dev builds AI agents from our Casablanca and Madrid engineering hubs under the security-first model described above. The engagement model pairs our [software development practice](https://callitdev.com/en/services/software-development) with our [AI/ML development practice](https://callitdev.com/en/services/software-development/ai-ml-development) and the operational coverage of our [BPO support tier](https://callitdev.com/en/services/bpo) for the human-in-the-loop layer. For the structural case on the Morocco delivery base, see [why Morocco](https://callitdev.com/en/why-morocco), and for the budgeting starting point, the [cost calculator](https://callitdev.com/en/cost-calculator).
If you are scoping defenses for agents already in production rather than picking a build partner, the companion piece is [AI agent security in 2026: the enterprise defense playbook](https://callitdev.com/en/blog/ai-agent-security-prompt-injection-enterprise-playbook-2026).
Security-first AI agent procurement does not slow the deal down. It changes what gets signed. The contract is longer by a few pages — the AI-BOM clause, the audit-rights clause, the AI-aware SLA, the incident path, the exit clause. The day rate is not meaningfully different from the same partner's rate twelve months ago. The risk-adjusted total cost of ownership, however, is lower, because the failure mode the buyer is hedging against — an injection-driven incident in a production agent that the buyer cannot quarantine, cannot diagnose, and cannot recover from — is the single fastest way to convert an AI investment into a write-down. The checklist exists to keep that from happening on a contract you signed.
${CTA_BLOCK}
Security became a contracting question rather than an internal one. The 17 June 2026 NeuralTrust USD 20M seed round, reported by PR Newswire, and OWASP's 2026 prompt-injection focus mean buyers now require named owners in the contract for secure design, secure construction and secure operation of every agent built by an outsourced partner.
The 2026 norm is a shared liability model with a cap proportional to fees, contingent on the partner demonstrating that the contractually-specified design controls were implemented. A vendor that refuses any liability for security defects in their own code is selling on yesterday's terms.
An AI Bill of Materials inventories the models, prompts, agents, datasets and tool integrations shipped in a release. Vendors who already produce one are operating at the 2026 standard. Requiring it in the contract is the diagnostic clause: it tells you whether the partner runs a mature AI SDLC or has to invent one for your engagement.
Direct injection, indirect injection through every untrusted input source, tool-result injection, privilege escalation across agent handoffs, and sandbox-escape against the orchestration framework. Microsoft Security Blog's May 2026 RCE disclosures make the sandbox-escape test non-negotiable. Cadence: at acceptance, after every major change, and at least annually.
Every agent action logged with full context — prompts, tool calls, tool responses, model and version, timestamps, side effects — into a store the buyer can access for the agreed retention period, append-only, replicated outside the partner's primary environment, auditable on reasonable notice.
Loaded engineering rates in Casablanca and Rabat for senior software engineers run roughly 60% lower than equivalent profiles in Southern Europe, with a wider gap against Northern Europe. Casablanca to Frankfurt is about a 2-hour direct flight, operationally equivalent to Bucharest or Warsaw for a procurement team that visits quarterly.
IT Outsourcing now represents approximately 40.3% of Moroccan offshoring export revenues (TechAfrica News, Atlas Brief coverage of the renewed Offshoring Offer), overtaking CRM and contact-center services at 37.4%. The Ataraxis Global Outsourcing Talent Index 2026 ranks Morocco 26th of 193 globally and 1st in the Maghreb.
A right to terminate, partner obligation to transition prompts, agent definitions, datasets, fine-tuned models and logs in a portable format, defined duration and price of transition assistance, and a destruction certificate for any residual data. A vendor that resists portable export is optimising for lock-in, which is a security risk in agent engagements as much as a commercial one.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777